1import * as Effect from "effect/Effect";
2import * as Binding from "../../Binding.ts";
3import * as Output from "../../Output.ts";
4import type { Role } from "../IAM/Role.ts";
5import { isBindingHost } from "../Lambda/Function.ts";
6import type { Datastore } from "./Datastore.ts";
7
8/**
9 * Shared scaffolding for AWS HealthImaging (medical-imaging) HTTP bindings.
10 *
11 * NOT exported from `index.ts` — every `{Op}Http.ts` in this service is a
12 * thin `Layer.effect(Cap, make…HttpBinding({ … }))` over one of the builders
13 * below. Everything except the operation and the IAM action list is
14 * boilerplate: every HealthImaging data-plane operation is scoped to one
15 * data store, whose id is injected as `datastoreId` and whose ARN (plus its
16 * `…/imageset/*` children — image-set operations are authorized against the
17 * image set sub-resource) receives the grant. `StartDICOMImportJob`
18 * additionally injects the bound data-access role and a scoped
19 * `iam:PassRole` grant.
20 */
21
22/**
23 * Build the impl Effect for a data-store-scoped HealthImaging operation
24 * (image set reads/writes, search, import job describes/lists): the runtime
25 * callable injects the bound {@link Datastore}'s id as `datastoreId` and the
26 * deploy-time half grants `actions` on the data store ARN and its
27 * `…/imageset/*` sub-resources.
28 */
29export const makeMedicalImagingDatastoreHttpBinding = <
30 I extends { datastoreId: string },
31 A,
32 E,
33 R,
34>(options: {
35 /** Fully-qualified binding tag, e.g. `AWS.MedicalImaging.GetImageSet`. */
36 tag: string;
37 /** The distilled operation; `datastoreId` is injected from the data store. */
38 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
39 /** IAM actions granted on the data store ARN + `…/imageset/*`. */
40 actions: readonly string[];
41}) =>
42 Effect.gen(function* () {
43 const op = yield* options.operation;
44
45 return Effect.fn(function* (datastore: Datastore) {
46 const DatastoreId = yield* datastore.datastoreId;
47 if (!globalThis.__ALCHEMY_RUNTIME__) {
48 const host = yield* Binding.Host;
49 if (isBindingHost(host)) {
50 yield* host.bind`Allow(${host}, ${options.tag}(${datastore}))`({
51 policyStatements: [
52 {
53 Effect: "Allow",
54 Action: [...options.actions],
55 Resource: [
56 Output.interpolate`${datastore.datastoreArn}`,
57 Output.interpolate`${datastore.datastoreArn}/imageset/*`,
58 ],
59 },
60 ],
61 });
62 }
63 }
64 return Effect.fn(`${options.tag}(${datastore.LogicalId})`)(function* (
65 request?: Omit<I, "datastoreId">,
66 ) {
67 return yield* op({
68 ...request,
69 datastoreId: yield* DatastoreId,
70 } as I);
71 });
72 });
73 });
74
75/**
76 * Build the impl Effect for the HealthImaging `StartDICOMImportJob`
77 * operation: the binding is constructed with the {@link Datastore} **and the
78 * data-access role** (the IAM role HealthImaging assumes to read the DICOM
79 * P10 input from S3 and write the import manifests; its trust policy must
80 * allow `medical-imaging.amazonaws.com`). The runtime callable injects the
81 * data store id as `datastoreId` and the role's ARN as `dataAccessRoleArn`;
82 * the deploy-time half grants `actions` on the data store ARN plus
83 * `iam:PassRole` on the role — without the PassRole grant, the import fails
84 * only at runtime with an AccessDeniedException.
85 */
86export const makeMedicalImagingStartJobHttpBinding = <
87 I extends { datastoreId: string; dataAccessRoleArn: string },
88 A,
89 E,
90 R,
91>(options: {
92 /** Fully-qualified binding tag, e.g. `AWS.MedicalImaging.StartDICOMImportJob`. */
93 tag: string;
94 /**
95 * The distilled operation; `datastoreId` and `dataAccessRoleArn` are
96 * injected from the bound resources.
97 */
98 operation: Effect.Effect<(input: I) => Effect.Effect<A, E>, never, R>;
99 /** IAM actions granted on the data store ARN. */
100 actions: readonly string[];
101}) =>
102 Effect.gen(function* () {
103 const op = yield* options.operation;
104
105 return Effect.fn(function* (datastore: Datastore, dataAccessRole: Role) {
106 const DatastoreId = yield* datastore.datastoreId;
107 const RoleArn = yield* dataAccessRole.roleArn;
108 if (!globalThis.__ALCHEMY_RUNTIME__) {
109 const host = yield* Binding.Host;
110 if (isBindingHost(host)) {
111 yield* host.bind`Allow(${host}, ${options.tag}(${datastore}, ${dataAccessRole}))`(
112 {
113 policyStatements: [
114 {
115 Effect: "Allow",
116 Action: [...options.actions],
117 Resource: [Output.interpolate`${datastore.datastoreArn}`],
118 },
119 // CRITICAL: without iam:PassRole on the data-access role,
120 // StartDICOMImportJob fails only at runtime with an
121 // AccessDenied.
122 {
123 Effect: "Allow",
124 Action: ["iam:PassRole"],
125 Resource: [Output.interpolate`${dataAccessRole.roleArn}`],
126 Condition: {
127 StringEquals: {
128 "iam:PassedToService": "medical-imaging.amazonaws.com",
129 },
130 },
131 },
132 ],
133 },
134 );
135 }
136 }
137 return Effect.fn(`${options.tag}(${datastore.LogicalId})`)(function* (
138 request: Omit<I, "datastoreId" | "dataAccessRoleArn"> & {
139 dataAccessRoleArn?: string;
140 },
141 ) {
142 return yield* op({
143 ...request,
144 datastoreId: yield* DatastoreId,
145 dataAccessRoleArn: request.dataAccessRoleArn ?? (yield* RoleArn),
146 } as I);
147 });
148 });
149 });